Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Astaroth Trojan Uses Cloudflare Workers to Bypass AV Software
#1
Bug 
Quote:A new malicious campaign is actively distributing a new Astaroth Trojan variant by abusing the Cloudflare Workers serverless computing platform to avoid detection and block automated analysis attempts.
 
Cloudflare Workers are scripts that run on Cloudflare servers from "data centers across 193 cities in 90 countries" and allow one to execute any JavaScript code without having to worry about infrastructure maintenance.
"Workers has a free plan which anyone or anything can sign up and get 100,000 total requests per day. You can create unlimited number of workers per account," as Check Point malware researcher Marcel Afrahim who discovered this Astaroth variant found.
 
Cloudflare Workers are used by Astaroth's operators as part of a three-stage infection process, starting with a phishing e-mail that comes with an HTML attachment containing obfuscated JavaScript code and linking to a domain that sits behind Cloudflare's infrastructure.
This domain is used to deliver several types of payloads in JSON format depending on the target's location to allow the attackers to quickly change the malicious files for various targets and to avoid getting blocked based on file object types sent to their potential victims' computers.

Read more here: https://www.bleepingcomputer.com/news/se...-software/
[-] The following 1 user says Thank You to silversurfer for this post:
  • harlan4096
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)
[-]
Welcome
You have to register before you can post on our site.

Username/Email:


Password:





[-]
Recent Posts
AWZ Screen Recorder
AWZ Screen Recorder ...zevish — 11:05
Website X5 Go 2024.1
Website X5 Go 2024.1...zevish — 09:32
Apple's rules to allow third-party app ...
Apple has announ...alison30 — 09:28
Intel: Microsoft AI PCs need a Copilot K...
Microsoft hopes th...harlan4096 — 08:55
Synchredible 8 Professional Edition v8.2...
          Synchredib...zevish — 08:54

[-]
Birthdays
Today's Birthdays
No birthdays today.
Upcoming Birthdays
No upcoming birthdays.

[-]
Online Staff
There are no staff members currently online.

>